LDR512: Security Leadership Essentials for Managers

Overview

The course starts with a tour of the information that effective security managers and leaders must know to function in the modern security environment. This includes an understanding of the different types of cybersecurity frameworks available to structure your security team and program. Risk is central to effective information security management, so we'll discuss key risk concepts in order to lay the foundation for effective risk assessment and management. Security policy is a key tool that security managers use to manage risk. We'll cover approaches to policy to help you plan and manage your policy process. Finally, we'll discuss security functions, reporting relationships, and roles and responsibilities to give the advancing manager a view into effective security team and program structure.

Full Lab Details

• Cyber42 Watt's Warehouse Company Overview
• Calibration Lab
• Cyber42 Round 1 Initiative Selection
• Cyber42 Round 1 Challenge #1: Whither Watt's Warehouse
• Cyber42 Round 1 Challenge #2: Institutionalizing Security
• Cyber42 Round 1 Challenge #3: Board Briefing

Full Topic Details

• Security Frameworks
• Control, Program, and Risk Frameworks
• Understanding Risk
• Risk Concepts
• Calibration
• Risk Assessment and Management
• Security Policy
• Purpose of Policy
• Risk Appetite Statement
• Policy Planning
• Managing Policy
• Program Structure
• Reporting Relationships
• Three Lines of Defense
• Roles and Responsibilities
• Security Functions

Overview

Section Two provides coverage of traditional and modern security architectures focused on technical topics. This includes a thorough discussion of network security that is modeled around the various layers of the network stack. As modern attacks are also focused on the computing devices, we cover malware and attack examples along with corresponding host security controls for the endpoint and server. The cloud is a major initiative that is changing the way organizations operate and design their controls. To get ready for these initiatives, we provide an overview of Amazon Web Services (AWS) to serve as a reference point and discuss key cloud security issues. As the rapid rise of cloud adoption has led to identity becoming the new perimeter, we also provide an overview of key Identity and Access Management (IAM) risks and capabilities. The cloud, the rise of mobile devices, and other factors are highlighting weaknesses in traditional, perimeter-oriented security architecture which leads into a discussion of the Zero Trust Model.

Full Lab Details

• Cyber42 Round 1 Challenge #4: Network Security Implementation
• Cyber42 Round 1 Challenge #5: End User Security
• Cyber42 Round 1 Challenge #6: To Serve and Protect
• Cyber42 Round 2 Challenge #7: AI Data Deal

Full Topic Details

• Security Architecture Overview
• Models and Trends
• Security Architecture Frameworks
• Cyber Defense Matrix
• Network Security
• Layer 1 and 2
• Overview and Attacks
• Layer 3
• VPNs and IPSec
• Layer 4
• TCP and UDP
• Application Layer
• Proxies, NGFW, IDS/IPS, NSM 
• Host Security 
• Malware and Attack Examples 
• Host Security Controls 
• EPP, EDR, HIDS/HIPS, FIM, Allowlisting, Sandboxing 
• Cloud Security
• Cloud Security Fundamentals
• AWS Security Reference Architecture
• AWS Overview
• Cloud Security Attack Example and Controls
• Cloud Security Tools
• CSPM, CWPP, CASB
• Cloud Security Models
• Cloud Security Alliance (CSA) Guidance, Well-Architected Frameworks, Cloud Adoption Frameworks
• Identity and Access Management (IAM)
• Authentication Factors
• Authentication and Access Attacks
• Passwordless, passkeys, and FIDO2
• IAM Security Capabilities
• Zero Trust
• Principles and Best Practices
• Zero Trust Network Access (ZTNA)
• Variable Trust

Overview 

Section Three focuses on security engineering best practices. This includes building an understanding of cryptography concepts, encryption algorithms, and applications of cryptography which are foundational elements of building any secure system. Managers must also be knowledgeable about software development processes, issues, and application vulnerabilities. We cover application security and leading development processes built on DevSecOps. Current engineering approaches also include modern Infrastructure as Code (IaC) approaches and tools to automate consistent deployment of standard configurations. Finally, GenAI and agentic AI have led to the growth of AI usage and newer LLM application architectures which need to be secured. 

Full Lab Details

• Cyber42 Round 2 Initiative Selection 
• Cyber42 Round 2 Challenge #8: Industry Breach 
• Cyber42 Round 2 Challenge #9: Security Misconfiguration 
• Cyber42 Round 2 Challenge #10: Miracle on DevOps Way 
• Cyber42 Round 2 Challenge #11: Shadow AI

Full Topic Details

• Security Engineering 
• Overview 
• Data Protection 
• Cryptography Concepts 
• Confidentiality, Integrity, Authentication, Non-Repudiation 
• Encryption Algorithms 
• Symmetric, Asymmetric, Key Exchange, Hashing, Digital Signature 
• Encryption Applications 
• TLS, PKI, Blockchain, Quantum 
• Application Security 
• Secure SDLC 
• Application Attacks 
• OWASP Top Ten 
• Application Security Tools 
• SAST, SCA, DAST, WAF, RASP 
• DevSecOps 
• DevOps Toolchain and Pipeline 
• Continuous Integrations and Continuous Delivery (CI / CD)
• Infrastructure as Code (IaC) 
• Container Security 
• GenAI and LLM Security 
• Innovations in Artificial Intelligence 
• Transformer Architecture 
• LLM Application Architecture 
• AWS Generative AI Security Scoping Matrix 
• AWS Agentic AI Security Scoping Matrix
• LLM Attacks 
• OWASP Top Ten for LLM Applications
• OWASP Top Ten for Agentic Applications
• MITRE ATLAS 
• Overreliance, Prompt Injection, Sensitive Information Disclosure, Model Theft, Training Data Poisoning, Excessive Agency, Jailbreaking 
• GenAI Security Controls 
• NIST AI Risk Management Framework (RMF) 
• AI Security Policy 
• LLMSecOps and Defensive Concepts
• AI Security Tools and Mitigations 

Overview 

Section Four covers what managers need to know about leading security initiatives. Every security leader should know how to build a vulnerability management program and the associated process to successfully find and fix vulnerabilities. Additionally, security awareness is a huge component of any security program that helps drive activities to change human behavior and create a more risk-aware and security-aware culture. Since data protection is a major global issue, we discuss the distinction between privacy and security to give managers a primer on key privacy requirements and concepts. To implement new initiatives, security leaders must also develop negotiation skills and conduct thorough analysist of vendors. Finally, for any project or initiative, security leaders must also be able to drive effective project execution. Having a well-grounded understanding of the management and leadership practices makes it easier to move your projects forward. 

Full Lab Details 

• Cyber42 Round 3 Initiative Selection 
• Cyber42 Round 3 Challenge #12: Patching Problems 
• Cyber42 Round 3 Challenge #13: Let It Be Known! 
• Cyber42 Round 3 Challenge #14: Tough Negotiations 
• Cyber42 Round 3 Challenge #15: Managing Resistance 

Full Topic Details

• Vulnerability Management 
• PIACT Process 
• Prioritizing Vulnerabilities 
• Common Vulnerability Scoring System (CVSS) 
• Exploit Prediction Scoring System (EPSS)
• Known Exploited Vulnerabilities (KEV)
• Finding and Fixing Vulnerabilities 
• Communicating and Managing Vulnerabilities 
• Security Awareness 
• Maturity Model 
• Human Risks 
• Privacy Primer 
• Privacy and Security 
• Requirements and Regulations 
• Privacy Engineering 
• Negotiations Primer 
• Negotiations Strategies 
• Vendor Analysis 
• Product Analysis and Selection 
• Analytical Hierarchy Process (AHP) 
• Managing and Leading Teams 
• Managing Projects 
• Leading Teams 
• Going From Good to Great 

Overview

Section Five focuses on detection and response capabilities. This includes gaining appropriate visibility via logging, monitoring, and strategic thinking about a security information and event management (SIEM) system. Once implemented, the logs in a SIEM are a core component of any Security Operations Center (SOC). We'll discuss the key functions of a SOC along with how to manage and organize your organization's security operations. The incident response process is discussed in relation to identifying, containing, eradicating, and recovering from security incidents. This leads into a discussion of longer-term business continuity planning and disaster recovery. Managers must also understand physical security controls that, when not implemented appropriately, can cause technical security controls to fail or be bypassed.

Full Lab Details

• Cyber42 Round 4 Initiative Selection
• Cyber42 Round 4 Challenge #16: The High Price of Visibility
• Cyber42 Round 4 Challenge #17: Cost Cutting
• Cyber42 Round 4 Challenge #18: Ransomware Response
• Cyber42 Round 4 Challenge #19: New Guy in Town
• Cyber42 Round 4 Challenge #20: Opportunity Knocks

Full Topic Details

• Logging and Monitoring
• SIEM Deployment Best Practices
• Evolution of Detection Capabilities
• Security Operations Center (SOC)
• SOC Functional Components 
• Models and Structure 
• Tiered vs. Tierless SOCs 
• Managing and Organizing a SOC 
• Cyber Incident Management
• PICERL Process 
• NIST Incident Handling Lifecycle 
• Contingency Planning 
• Business Continuity Planning (BCP) 
• Disaster Recovery (DR) 
• Physical Security 
• Issues and Controls